From: Rasmus Lerdorf <rasmus@php.net>
Date: Sun, 8 May 2005 17:24:38 +0000 (+0000)
Subject: Fix request_uri XSS on phpinfo() page
X-Git-Tag: php-5.0.1b1~281
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=310dd4a21428b4df8c71839ae139c82b253f35c5;p=php

Fix request_uri XSS on phpinfo() page
---

diff --git a/ext/standard/info.c b/ext/standard/info.c
index c5485e7557..bc278b5f30 100644
--- a/ext/standard/info.c
+++ b/ext/standard/info.c
@@ -406,7 +406,9 @@ PHPAPI void php_print_info(int flag TSRMLS_DC)
 		if (expose_php && !sapi_module.phpinfo_as_text) {
 			PUTS("<a href=\"http://www.php.net/\"><img border=\"0\" src=\"");
 			if (SG(request_info).request_uri) {
-				PUTS(SG(request_info).request_uri);
+				char *elem_esc = php_info_html_esc(SG(request_info).request_uri TSRMLS_CC);
+				PUTS(elem_esc);
+				efree(elem_esc);
 			}
 			PUTS("?=");
 			logo_guid = php_logo_guid();
@@ -592,7 +594,9 @@ PHPAPI void php_print_info(int flag TSRMLS_DC)
 		if (expose_php && !sapi_module.phpinfo_as_text) {
 			PUTS("<a href=\"http://www.zend.com/\"><img border=\"0\" src=\"");
 			if (SG(request_info).request_uri) {
-				PUTS(SG(request_info).request_uri);
+				char *elem_esc = php_info_html_esc(SG(request_info).request_uri TSRMLS_CC);
+				PUTS(elem_esc);
+				efree(elem_esc);
 			}
 			PUTS("?="ZEND_LOGO_GUID"\" alt=\"Zend logo\" /></a>\n");
 		}
@@ -611,7 +615,9 @@ PHPAPI void php_print_info(int flag TSRMLS_DC)
 		php_info_print_hr();
 		PUTS("<h1><a href=\"");
 		if (SG(request_info).request_uri) {
-			PUTS(SG(request_info).request_uri);
+			char *elem_esc = php_info_html_esc(SG(request_info).request_uri TSRMLS_CC);
+			PUTS(elem_esc);
+			efree(elem_esc);
 		}
 		PUTS("?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000\">");
 		PUTS("PHP Credits");